Computers are used to perform a wide assortment of tasks. Often computers are connected together as a group of computers known as a network. Referring to FIG. 1, a network workgroup is made up of a first client (10), a second client (12), with a connection (18) at one location, for example, an Ethernet connection. Using a router (20), a connection is made to a remote network via a hub (22). Connected to the hub (22) are a first remote client (24) and a second remote client (26). The entire networked workgroup is able to connect to a wide area network (32), e.g., the Internet, via the router (20). Connecting to the network via remote access is increasing in popularity as users seek to use computers away from the central network workgroup. In such cases, a remote client may be connected to the central network workgroup via a telephone line and a communication device known as a modem.
Managing dispersed serial connections and modem pools for large numbers of local and remote users creates the need for significant administrative support and careful attention to security and authorization. One method of security is to use public key technology although one skilled in the art can appreciate that other security methods may be used.
The basic concept involved in public key technology is a mathematical concept that can be used to relate certain pairs of large numbers (called keys) in a special way. If one of the keys is used to encrypt a message, the other key can be used to decrypt the message, and vice versa. Fundamental to this scheme is that only these two keys (called a key pair) are related in this way. So, in other words, if a message is encrypted with one key, the message can be decrypted only by the matching key in the pair. One key is called a private key and the other is called a public key. The private key is known only by the end user; the public key is published as widely as the end user desires.
Following is an example of how a private message is sent from a sender to a recipient. The recipient's public key is used to encrypt the message, which is then sent to the recipient, and the recipient uses his/her private key to decrypt the message. The sender knows that only the recipient can read the message because the message can only be decrypted using the recipient's private key. One concern with this arrangement is that the sender does not know whether the recipient's true public key is being used to encrypt the message. To overcome this concern, a certificate is employed.
A certificate binds a public key to an identity (and possibly other information about that identity). The sender and recipient share a trusted third party (e.g. a mutual friend, an organizational administrator, or a government agency). If the recipient goes to that trusted third party and proves his/her identity and presents his/her public key, that third party bundles and “signs”, or verifies the authenticity of the public key along with the recipient's identity and any other appropriate information. This bundle of information is called a certificate, and the process of obtaining one is called certificate issuance.
A notable property of certificates is that public key tampering can be readily detected. The certificate is signed by the trusted third party (called a certificate authority, or CA), so that the sender is able to tell if the certificate has been tampered. The sender can tell because the CA is not recognized or the certification is improperly signed. Also, the sender can look at the certificate and verify that the certificate was, in fact, signed by the intended trusted third party. This mechanism assures that the recipient's public key really belongs to the recipient, at least to the level that trust exists in the certificate authority.
When a document is digitally signed, a mathematical value or “hash” is computed from all of the information that makes up this document. Then, the signer encrypts this hash using his private key. The signer attaches this encrypted hash along with his certificate, which also includes his public-key, to the original document.
When the authenticity of the document is to be verified, the verifier first verifies the authenticity of the signer's certificate, decrypt the signed hash using the signer's public key and then compare the signer's hash with a new hash of the original document. If the hashes match, then this document is the same one that the signer signed.
Computer security systems often include the use of security devices, such as memory sticks, security tokens, smart cards, etc. to store security information such as private keys, certificates, etc. for authentication purposes. A memory stick is a digital data storage device designed to be a standard storage and transfer media. Security tokens are typically electronic devices that include computer circuitry, built-in cryptographic functionality, a visual display, and battery. Some security tokens may also contain a keypad and a built in clock. Security tokens may range in size from credit card size to key-ring-attachment size. Smart cards are plastic, credit card sized, and tamper-resistant cards that include electronics components that serve as non-volatile memory, a microprocessor (a type of small computer), cryptographic components, and a random number generator.
The basic functionality of a computer is dictated by the type of operating system it uses. Various operating systems exist in the market place, including Solaris™ from Sun Microsystems Inc., Palo Alto, Calif., MacOS® from Apple Computer, Inc., Cupertino, Calif., Windows® 2000 and Windows NT®, from Microsoft Corporation, Redmond, Wash., and Linux. The different types of operating systems will be referred to herein as “platforms”. Prior to the popularity of the Internet, software developers wrote programs specifically designed for individual platforms. Thus, a program written for one platform could not be run on another. However, the advent of the Internet made cross-platform compatibility a necessity.
The Java™ programming language was developed by Sun Microsystems, Inc. to address the problem of cross-platform compatibility. The Java™ programming language was designed to be simple for the programmer to use, yet able to run securely over a network and work on a wide range of platforms. A discussion of the Java™ language itself is beyond the scope of this document.
Java-enabled web browsers or similar computer applications such as Netscape® Navigator and Microsoft® Internet Explorer can execute a class of Java programs called applets to provide customized end user interface. Applets are like Java applications except that they automatically provide certain network communication capabilities and execute on the client machine in a protected environment for security precautions. Applets are written so that at run time, the applet may request additional privileges from the user of the Java-enabled web browser. If the request is granted by the user, the applet may operate outside of this secure environment.
Lightweight Directory Access Protocol (LDAP) is the Internet standard for directory lookups, just as the Simple Mail Transfer Protocol (SMTP) is the Internet standard for delivering e-mail and the Hypertext Transfer Protocol (HTTP) is the Internet standard for delivering documents. Technically, LDAP is defined as an on-the-wire bit protocol (similar to HTTP) that runs over Transmission Control Protocol/Internet Protocol (TCP/IP). LDAP creates a standard way for applications to request and manage directory information.
LDAP is an electronic communications protocol for enabling anyone to locate organizations, individuals, and other resources such as files and devices in a network, e.g., on the Internet or an Intranet. An LDAP-compliant directory leverages a single, master directory that owns all end user, group, and access control information. The directory is hierarchical, not relational, and is optimized for reading, reliability, and scalability. This directory becomes a specialized, central repository that contains information about objects and provides end user, group, and access control information to all applications on the network. For example, text, photos, links to web pages, binary data, and public key certificates may be stored in a directory and retrieved from a directory. The directory may be used to support a public key infrastructure (PKI). Typical use of PKI is in secure document distribution signing, and verification (such as encrypting, decrypting, and authenticating origin). The directory may also be used to provide the security management system with an end user list or end user identification for all end users in a widely spanning enterprise.